What is the CVSS score of CVE-2026-43738?

CVE-2026-43738 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-43738?

Yes, a patch is available for CVE-2026-43738. Update the affected software to the latest version immediately.

Apple CVE-2026-43738

EUVD-2026-49482 MEDIUM

Out-of-bounds Read (CWE-125)

2026-07-27 apple

GHSA-mvxm-m976-r6c2

Buffer Overflow Information Disclosure Apple

5.5

CVSS 3.1 · Vendor: apple

Severity by source

Vendor (apple) PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Primary rating from Vendor (apple) · only source for this CVE.

CVSS VectorVendor: apple

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 16:56 vuln.today

Patch available

Jul 27, 2026 - 21:17 EUVD

CVE Published

Jul 27, 2026 - 20:12 cve.org

MEDIUM 5.5

CVE Published

Jul 27, 2026 - 20:12 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. Processing a maliciously crafted asset catalog may result in disclosure of process memory.

AnalysisAI

Information disclosure in macOS asset catalog processing allows local attackers to read process memory by enticing a user to open a malicious asset catalog. Affected versions prior to macOS Sequoia 15.7.8 and Sonoma 14.8.8 are vulnerable. No active exploitation or public exploit code exists; EPSS indicates low exploitation probability.